Thanks, I checked.These "wuauclt /resetauthorization" and "wuauclt /detectnow" do not help. That question refers to the same symptom but the solution just do not work for my case. At this stage I'm unsure if this is a Windows Server or Azure issue...
– Olivier DaubyJun 8 '16 at 10:29

have you tested connectivity from those servers to the update URLs?
– CtrlDotJun 9 '16 at 3:01

Those servers apparently have access to the update URLs since the optional updates are listed and downloadable.
– Olivier DaubyJun 9 '16 at 16:20

Depending on the release date of your 2012 R2 install media, 2919335 may or may not be present. There are some DISM command to add it to older media, I think it was incorporated into media released after April 2014.

Public Windows Update Servers (this is the default on Azure). The servers having the issue have been provisioned Q1&Q2 2016, so I assume this is not related to changes introduced in April 2014.
– Olivier DaubyJun 9 '16 at 16:28